Welcome back to Cybersecurity from Zero to Hero, the series where I learn security from scratch and write it down while the confusion is still fresh. In post one we met the CIA Triad, the three promises every security control exists to protect. Today we learn the three words that describe how those promises get broken.
Here is the problem. Security articles throw around threat, vulnerability and risk as if they were synonyms. They are not. Once I finally separated them, every security article I read became twice as clear, and I could suddenly follow conversations that used to sound like noise.
🏠 The house analogy that made it stick
Imagine your house.
A threat is anything out there that could cause harm. The burglar walking through your neighborhood. The storm forming offshore. The threat exists whether or not your house has any weaknesses. You do not control threats. They are simply out there.
A vulnerability is a weakness in your house. The broken lock on the back door. The window that does not close properly. A vulnerability by itself harms nothing. A broken lock in a neighborhood with zero burglars is just a broken lock.
Risk is what happens when the two meet. It is the likelihood that a threat actually exploits a vulnerability, multiplied by how bad it would be. Burglar in the area, plus broken lock, plus your laptop and passport sitting inside: now you have real risk.
The formula you will see everywhere in this field:
Risk = Threat x Vulnerability x Impact
Kill any one of the three and the risk collapses. You cannot remove the burglar, but you can fix the lock, or move the passport to a safe. That is what security work actually is: reducing risk by attacking the parts you control.
💻 Translating it to computers
The same three words, now in tech form:
Threats: ransomware gangs, phishing crews, a disgruntled employee, even a hurricane heading for a data center. Remember post one: not every threat is a hacker.
Vulnerabilities: an unpatched server, a weak password, an employee who has never heard of phishing, a database left open to the internet.
Risk: an active ransomware gang targeting your industry, plus your unpatched server, plus that server holding customer data. High likelihood, high impact, high risk.
This also explains something that used to puzzle me. Why do companies leave some known vulnerabilities unfixed? Because risk is a business decision. If the vulnerability sits on an internal test machine with no valuable data, the risk is low and the fix can wait. Security teams do not fix everything. They fix what matters most first. That is called risk management, and it is the actual day job behind most security roles.
📝 *What I actually did: rating three risks in my own life
*
Reading definitions is easy, so I forced myself to apply them. I listed three real risks in my own digital life and scored likelihood and impact from 1 to 5.
Risk 1: password reuse. Threat: credential stuffing attacks using leaked password lists. Vulnerability: I reuse a password across several old accounts. Likelihood 4, impact 4. Score 16, my worst one. The fix costs nothing: a password manager and an hour of cleanup. That is this weekend's task.
Risk 2: phishing. Threat: phishing emails, which everyone receives. Vulnerability: I read email fast and on my phone, where sender addresses are hidden by default. Likelihood 3, impact 4, score 12. Fix: slow down on anything asking me to click or log in.
Risk 3: laptop theft. Threat: ordinary theft in cafes and transit. Vulnerability: my disk was not encrypted. Likelihood 2, impact 5, score 10. Fix: I turned on full disk encryption today. It took five minutes and one restart. If you do nothing else after reading this, check yours: BitLocker on Windows, FileVault on Mac.
Try this exercise yourself. Three risks, two scores each, five minutes. It turns abstract vocabulary into a to do list, and it is exactly what professional risk assessments do at a much larger scale.
🤔 What confused me today
Is a hacker a threat or a threat actor? Strictly, the person or group is the threat actor, and the thing they might do is the threat. A ransomware gang is the actor, ransomware attack is the threat. People mix these constantly and the world keeps turning, but knowing the distinction helps when reading serious reports.
Where do exploits fit? An exploit is the actual tool or technique that takes advantage of a vulnerability. Broken lock is the vulnerability, the crowbar technique is the exploit. We will meet real ones later in the series, safely and legally.
⏭️ Next in this series
Post 3 covers authentication versus authorization, the difference between proving who you are and what you are allowed to do. It is the concept behind every login screen you have ever seen, and the hands on part maps a real website login flow. Follow the series so you do not miss it.
